Fix handling of empty header list entries in http_request_split_value, fixing invalid read in valgrind (fixes #2413)

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2830 152afb58-edef-0310-8abb-c4023f1b3aa9

NEWS

@@ -9,6 +9,7 @@ NEWS
   * [mod_compress] fix handling if etags are disabled but cache-dir is set - may lead to double response
   * disable mmap by default (fixes #2391)
   * buffer_caseless_compare: always convert letters to lowercase to get transitive results, fixing array lookups (fixes #2405)
+  * Fix handling of empty header list entries in http_request_split_value, fixing invalid read in valgrind (fixes #2413)
 
 - 1.4.30 - 2011-12-18
   * Always use our 'own' md5 implementation, fixes linking issues on MacOS (fixes #2331)

src/request.c

@@ -241,9 +241,11 @@ static int http_request_split_value(array *vals, buffer *b) {
 			start = s;
 
 			for (; *s != ',' && i < b->used - 1; i++, s++);
+			if (start == s) break; /* empty fields are skipped */
 			end = s - 1;
 
-			for (; (*end == ' ' || *end == '\t') && end > start; end--);
+			for (; end > start && (*end == ' ' || *end == '\t'); end--);
+			if (start == end) break; /* empty fields are skipped */
 
 			if (NULL == (ds = (data_string *)array_get_unused_element(vals, TYPE_STRING))) {
 				ds = data_string_init();